TCC Bypass via Mounted APFS Snapshot Access

Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple’s privacy framework (TCC).

Elastic rule (View on GitHub)

 1[metadata]
 2creation_date = "2020/01/04"
 3integration = ["endpoint"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots
13as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file
14system, including all user data and files protected by Apple’s privacy framework (TCC).
15"""
16from = "now-9m"
17index = ["auditbeat-*", "logs-endpoint.events.*"]
18language = "kuery"
19license = "Elastic License v2"
20name = "TCC Bypass via Mounted APFS Snapshot Access"
21references = ["https://theevilbit.github.io/posts/cve_2020_9771/"]
22risk_score = 73
23rule_id = "b00bcd89-000c-4425-b94c-716ef67762f6"
24severity = "high"
25tags = ["Domain: Endpoint", "OS: macOS", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Use Case: Vulnerability", "Data Source: Elastic Defend"]
26timestamp_override = "event.ingested"
27type = "query"
28
29query = '''
30event.category:process and host.os.type:macos and event.type:(start or process_started) and process.name:mount_apfs and
31  process.args:(/System/Volumes/Data and noowners)
32'''
33
34
35[[rule.threat]]
36framework = "MITRE ATT&CK"
37[[rule.threat.technique]]
38id = "T1006"
39name = "Direct Volume Access"
40reference = "https://attack.mitre.org/techniques/T1006/"
41
42
43[rule.threat.tactic]
44id = "TA0005"
45name = "Defense Evasion"
46reference = "https://attack.mitre.org/tactics/TA0005/"

References

Related rules

to-top